Security at Zellio AI

At Rest

All sensitive data including access tokens, customer information, and passwords are encrypted using AES-256-GCM encryption with unique initialization vectors for each record.

In Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.3 with modern cipher suites.

Backups

Database backups are encrypted using the same standards as production data and stored securely with access controls.

Role-Based Access Control (RBAC)

We implement strict role-based permissions:

• Owner Full access to workspace and all features
• Admin Manage users, integrations, and settings
• Agent Handle customer conversations and support

Workspace Isolation

All customer data is isolated by workspace. Users can only access data from workspaces they belong to.

Password Requirements

Minimum 8 characters required. All passwords are hashed using bcrypt with salt rounds before storage.

Hosting

Our application is hosted on enterprise-grade cloud infrastructure (Railway/AWS) with:

• DDoS protection
• Automated security patches
• Network isolation and firewalls
• 24/7 monitoring and intrusion detection

Database

We use managed PostgreSQL databases with:

• Automated daily backups with point-in-time recovery
• Encrypted connections (SSL/TLS)
• Network access restrictions
• Regular security updates

Environment Separation

We maintain completely separate development, staging, and production environments. Test data never touches production systems.

GDPR Compliance

We comply with the General Data Protection Regulation (GDPR) for EU users, including:

• Right to access, rectification, and erasure
• Data portability
• Breach notification within 72 hours
• Data processing agreements

CCPA Compliance

We comply with the California Consumer Privacy Act, including the right to know, delete, and opt-out.

Shopify Security Requirements

As a Shopify app, we meet all Shopify security and privacy requirements, including Protected Customer Data access controls.

Meta Tech Partner Security

We adhere to Meta's Tech Partner Security Requirements, including strict data isolation, encryption standards, and regular security assessments to protect user data shared via our platform integrations.

Security Incident Response Policy

We have a documented security incident response policy that includes:

• Detection 24/7 monitoring and automated alerts
• Containment Immediate steps to isolate and stop the incident
• Notification Affected merchants notified within 72 hours
• Recovery Restore systems and data from secure backups
• Post-incident Root cause analysis and preventive measures

pages.security.section5.subsection2.title

pages.security.section5.subsection2.content

pages.security.section5.subsection2.response

Retention Policy

We retain customer data only as long as necessary to provide our services:

• Active workspaces: Data retained while workspace is active
• Deleted workspaces: All data permanently deleted within 30 days
• Backups: Deleted according to our 90-day backup retention schedule

Secure Deletion

When data is deleted, it is permanently removed from our production databases and cannot be recovered. Backup data is automatically purged according to our retention schedule.